Description
Integer signedness error in FIFO filesystems (named pipes) on Sun Solaris 8 through 10 allows local users to read the contents of unspecified memory locations via a negative maximum length value to the I_PEEK ioctl.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Solaris 8/9/10 - 'fifofs I_PEEK' Local Kernel Memory Leak EDB-5227 · local · Mar 10, 2008 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 20071004 Re: iDefense Security Advisory 10.02.07: Sun Microsystems Solaris FIFO FS Information Disclosure Vulnerability mailing-list
- 27654 third-party-advisory
- 5227 exploit
- 27024 third-party-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2007-463.htm
- 25905 vdb-entry
- ADV-2007-3339 vdb-entry
- solaris-namedpipes-information-disclosure(36918) vdb-entry
- 4516 exploit
- oval:org.mitre.oval:def:2170 vdb-entry signature
- 103061 vendor-advisory
- 1018766 vdb-entry
- 20071002 Sun Microsystems Solaris FIFO FS Information Disclosure Vulnerability third-party-advisory